Ranked deck pool: curate to a fixed allowlist (fixes cross-install fairness bug)

**Status: root cause confirmed** (correctness bug) + design

## Summary
The ranked draft builds its pool from `G.P_CENTER_POOLS.Back` on the **host** (`pvp_api/actions.lua:91`, and `api/ban_pick.lua:527` in BalatroMultiplayerAPI) — every deck back the host's installed mods registered. The pool is broadcast to the guest, who may not have those decks; an unresolvable deck key is a broken match, not a balance issue. Correctness bug, latent or live depending on whether ranked players can load arbitrary deck mods.

## Proposal
Ranked draws from an explicit curated allowlist in the mod, not the install-global pool:
- **Included:** all vanilla decks + Violet + Orange + Cocktail.
- **Explicitly excluded** (exist but are not ranked-legal): **Echo**, **Heisenberg**.
- Every included deck ships with vanilla or the PvP mod itself, so both clients are guaranteed to have them — this fixes the fairness bug by construction, no server authority required.
- Draft mechanic unchanged: sample 9 (deck + random stake) combos from the allowlist, ban combos, pick one.

## Open questions
- **Server authority** — whether to move the ranked list server-side later (live meta changes / instant deck bans without a client patch). Not needed for the fairness fix; open for the future.
- **Cocktail** in the pool is gated on the weekly-cocktail API (#492) — ship ranked with vanilla + Violet + Orange first, add Cocktail when that lands.

Start by reading the ranked pool construction in pvp_api/actions.lua around line 91 and compare it with api/ban_pick.lua around line 527 in BalatroMultiplayerAPI. Trace how deck keys are collected and broadcast, then verify the draft still samples nine deck-and-stake combinations while restricting ranked choices to the stated legal decks. Done means a ranked match cannot offer an install-only deck to the other client.

Written by the indexing model from the issue text.